Skip to content
OpenAdvisories
Medium ALAS2023-2025-1153 1 CVE

Moderate: libtiff security update (Amazon Linux 2023)

Published Aug 18, 2025 · Updated Sep 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8176: A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libtiff 0:4.4.0-4.amzn2023.0.20
Amazon Linux · 2023 libtiff-debuginfo 0:4.4.0-4.amzn2023.0.20
Amazon Linux · 2023 libtiff-debugsource 0:4.4.0-4.amzn2023.0.20
Amazon Linux · 2023 libtiff-devel 0:4.4.0-4.amzn2023.0.20
Amazon Linux · 2023 libtiff-static 0:4.4.0-4.amzn2023.0.20
Amazon Linux · 2023 libtiff-tools 0:4.4.0-4.amzn2023.0.20
Amazon Linux · 2023 libtiff-tools-debuginfo 0:4.4.0-4.amzn2023.0.20

Vulnerabilities 1

  • Medium 5.3
    CVE-2025-8176

    LibTIFF tiffmedian.c get_histogram use after free

    A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The …

    tiff tiff libtiff tiff Debian Ubuntu Azure Linux Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-8176.html